Logs not picking sourcetype from props.conf in apps/local folder on heavy forwarder

[arunkumarkyamaj]

Hi,
we want to parse the logs on HF before logs are forwarded to indexers. logs are forwarded from universal forwarder to heavy forwarder. I have given sourcetype in inputs.conf on UF and created props.conf with same sourcetype value stanza( extract = regex). logs are comeing with sourcetype i have given in inputs.conf but its not picking file in props.conf where the regex is. so logs are not parsed. i have tested props.conf and it parsed correctly on test environment but this by uploading file. Am i missing anything here ?

[arjunpkishore5 · Accepted solution]

There's your problem, EXTRACT is used to define search time filed extractions and not index time extractions, these work only on your search head.

On your heavy forwarder, you need to use TRANSFORM- along with an accompanying transforms.conf - https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Transformsconf

[arunkumarkyamaj]

Thank you! that worked.

[arjunpkishore5]

Have you also placed the props.conf on the UF? If yes, remove the props.conf on the UF. Could you also paste the contents of the props.conf here?

[richgalloway]

Did you load the props.conf file on the HF and restart the HF?

[arunkumarkyamaj]

yes. i did.